What’s Vulnerable › Vulnerabilities

CVE-2024-50340: Ability to change environment from query in symfony/runtime

• Severity: high (CVSS 7.3 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 63.6% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2024-11-06 · updated 2026-06-17
• Weakness: CWE-74

Description

symfony/runtime is a module for the Symphony PHP framework which enables decoupling PHP applications from global state. When the `register_argv_argc` php directive is set to `on` , and users call any URL with a special crafted query string, they are able to change the environment or debug mode used by the kernel when handling the request. As of versions 5.4.46, 6.4.14, and 7.1.7 the `SymfonyRuntime` now ignores the `argv` values for non-SAPI PHP runtimes. All users are advised to upgrade. There are no known workarounds for this vulnerability.

Affected products

• symfony: before 5.4.46; from 6.0.0 before 6.4.14; from 7.0.0 before 7.1.7 — fixed in 5.4.46, 6.4.14, 7.1.7

How to fix

Upgrade to a fixed version: symfony 5.4.46, 6.4.14, 7.1.7. Check the vendor advisory for mitigations.

References

• https://github.com/symfony/symfony/commit/a77b308c3f179ed7c8a8bc295f82b2d6ee3493fa
• https://github.com/symfony/symfony/security/advisories/GHSA-x8vp-gf4q-mw5j

Get alerted when CVE-2024-50340 or the next vulnerability affects your stack